read_fileLABSCO SUMMARY
Add `--network none` and the agent cannot phone home.
The default container already blocks the usual escapes: no capabilities, read-only root, non-root user, hard CPU and PID limits, and a path validator that refuses anything outside /workspace. Disabling the network stack goes further and leaves only loopback inside. The trade is real — with the network off the agent cannot install packages at runtime, so dependencies have to be baked into a custom image or already sitting in the mounted volume.
What it is
A Python MCP server running inside a locked-down container: non-root, all Linux capabilities dropped, read-only root filesystem, and hard CPU, memory and PID limits. The agent gets file and shell tools scoped to /workspace, the only directory mounted from your machine.
What you get
- Files read with
offsetandlimit, written with syntax validation, listed with file and directory prefixes, and found by glob with exclusions —read_file,write_file,list_directory,search_workspace - Shell commands run in
/workspaceunder a mandatory timeout, with output compressed to cut token use —run_bash - Multi-edit find-and-replace with fuzzy whitespace matching, indentation preservation, a dry-run mode and syntax validation for Python, JSON, JSONL, TOML and YAML —
search_and_replace - Guardrails on writes: existing files are not overwritten by default, and there is a 5MB size guard
Requirements
Docker. Pull ghcr.io/hrrodan/agent-workspace-mcp:latest or build it with your own UID and GID, then have the client launch the container with your project directory mounted at /workspace. On Linux replace 1000:1000 with your real UID and GID — Claude Desktop does not expand environment variables — and keep --init so signals are forwarded. Environment variables tune it: COMMAND_TIMEOUT (default 60), MAX_SEARCH_RESULTS (default 50), MAX_READ_SIZE_BYTES (default 1048576), MAX_WRITE_SIZE_BYTES (default 5242880) and LOG_LEVEL (default INFO).
Setup effort
One command — docker pull ghcr.io/hrrodan/agent-workspace-mcp:latest
USE CASES
01
Letting an agent run the code it just wrote
Give it a shell inside the container instead of on your machine, with a timeout on every command.
02
Refactoring without breaking the file
Preview the edit as a dry run and let the syntax check reject a change that would leave the file unparseable.
03
Exploring an unfamiliar repository
Find files by glob with the noisy directories excluded, then read the ones that matter in slices.
04
Reviewing untrusted code
Run it in an air-gapped container so nothing it does can reach the network or the rest of your disk.
6 tools
Listed in project docs. Your client may show a different list.
write_filelist_directorysearch_workspacerun_bashsearch_and_replaceBEFORE YOU INSTALL
What to know first
Tools you get
6 tools named in the project's documentation.
Where it runs
Both documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
docker pull ghcr.io/hrrodan/agent-workspace-mcp:latestMCP Clients
Claude Desktop, Cursor
JSON
{
"mcpServers": {
"agent-workspace-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"--init",
"--memory=2g",
"--cpus=2.0",
"--pids-limit=256",
"--cap-drop=ALL",
"--security-opt=no-new-privileges:true",
"--read-only",
"--tmpfs",
"/tmp:size=64m",
"--tmpfs",
"/home/mcpuser/.cache:size=512m",
"--user",
"1000:1000",
"-v",
"<YOUR_PATH_TO_PROJECTS>:/workspace",
"ghcr.io/hrrodan/agent-workspace-mcp:latest"
]
}
}
}<YOUR_PATH_TO_PROJECTS> is the folder on your machine the agent may work in; it is mounted as /workspace. /tmp and /home/mcpuser/.cache are temporary folders inside the container — leave them as they are. On Linux, 1000:1000 is a sample; yours is your own UID:GID (id -u and id -g).
